# From Detection to Prevention: Explaining Security-Critical Code to Avoid Vulnerabilities

arXiv: https://arxiv.org/abs/2602.00711 · HTML: https://mlsanity.com/paper/2602.00711/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 3 of its 14 references that are in the map.
- First posted on arXiv 31 Jan 2026.

## Builds on (most cited first, 3 of 3)

- [Do I really need all this work to find vulnerabilities? An empirical case study comparing vulnerability detection techniques on a Java application](https://mlsanity.com/paper/2208.01595/) (2022)
- [Detecting Security-Relevant Methods using Multi-label Machine Learning](https://mlsanity.com/paper/2403.07501/) (2024)
- [To what extent can we analyze Kotlin programs using existing Java taint analysis tools? (Extended Version)](https://mlsanity.com/paper/2207.09379/) (2022)

## Abstract (arXiv)

Security vulnerabilities often arise unintentionally during development due to a lack of security expertise and code complexity. Traditional tools, such as static and dynamic analysis, detect vulnerabilities only after they are introduced in code, leading to costly remediation. This work explores a proactive strategy to prevent vulnerabilities by highlighting code regions that implement security-critical functionality -- such as data access, authentication, and input handling -- and providing guidance for their secure implementation. We present an IntelliJ IDEA plugin prototype that uses code-level software metrics to identify potentially security-critical methods and large language models (LLMs) to generate prevention-oriented explanations. Our initial evaluation on the Spring-PetClinic application shows that the selected metrics identify most known security-critical methods, while an LLM provides actionable, prevention-focused insights. Although these metrics capture structural properties rather than semantic aspects of security, this work lays the foundation for code-level security-aware metrics and enhanced explanations.